---
title: "Stores"
slug: "stores"
status: "update"
updated: 2025-11-16T17:33:29Z
published: 2025-11-16T17:33:29Z
canonical: "docs.plainid.io/stores"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Stores

## Configuring a Secret Store

The **Secret Store** retrieves relevant Secrets—such as private keys, tokens, or database credentials—for use at Runtime. The Secrets Management Service supports various store integrations, allowing multiple Secret Stores to be defined in a single configuration. This flexibility enables you to source Secrets from different providers based on their intended use or target environment.

Each configured store must include a unique `id`, which is later referenced when defining how and where a Secret is used. You can define one store as the default, or specify the store explicitly for each Secret.

Refer to the individual Secret Store pages for store-specific parameters and examples based on the following parameters:

* [Hashicorp](/v1/docs/hashicorp){target=`_blank`}
* [AWS Secret Manager](/v1/docs/aws-secret-manager){target=`_blank`}
* [AWS RDS IAM Authentication](/v1/docs/aws-rds-iam-authentication){target=`_blank`}
* [Azure Key Vault](/v1/docs/azure-key-vault){target=`_blank`}
* [CyberArk CCP](/v1/docs/cyberark-ccp){target=`_blank`} 

---

### General Store Parameters

The following example shows how to define one or more Secret Stores in your configuration. Each store is defined under the top-level `secretStore` section.

```yaml
secretStore:
  - id: vault
    type: Vault
    isDefault: true
    details:
      defaultPath: vault_
      skipVerify: true
      url: vault
      timeout: 3s
      enginePath: custom
      pathPrefix: prefix
    auth:  # Authentication can be via Token or Kubernetes
      method: Token  # Token, Kubernetes
      tokenValue: token
#    tokenFileName: ${ VAULT_TOKEN }  # Optional alternative to tokenValue
#
#  auth:
#    method: Kubernetes
#    path: /var/path-to-file/file.txt
#    role: secrets-mgmt
```

---

### Parameter Reference 

The table below describes the common parameters used when configuring a Secret Store. Store-specific parameters are defined under the `details` object and vary by store type.

| Parameter             | Value    | Description                                                                                                                                                                                                                                                                     |
| --------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id`                  | `vault`  | A unique identifier for the Secret Store. This ID is used when referencing the store in other configuration blocks.                                                                                                                                                             |
| `type`                | `Vault`  | The type of Secret Store. Supported types include:<br>- `Vault`<br>- `AWSRDSIAMAuth`<br>- `AWSSecretsManager`<br>- `AzureKeyVault`<br>- `Environment`<br>- `File`                                                                                                               |
| `isDefault`           | `true`   | Indicates whether this store should be used as the default. If multiple Secret Stores are configured, the default is used when a store is not explicitly specified. If no store is marked as default—or if more than one is—then the first listed store is used as the default. |
| `Decoder`             | `none`   | Optional. The decoder to use when retrieving the Secret value. Supported values are:<br>- `Base64`<br>- `None`                                                                                                                                                                  |
| `details`             | —        | A section containing additional store-specific parameters. These vary depending on the selected `type` and are documented on the individual store pages.                                                                                                                        |
| `details.defaultPath` | `vault_` | Optional. The default path to use when accessing Secrets in the store. This can be used as a prefix or fallback location.                                                                                                                                                       |

---